k8scd/immich/helm-immich.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: helm-immich
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
spec:
  syncPolicy:
    syncOptions:
      - CreateNamespace=true
    automated:
      prune: true
      selfHeal: true
  project: default
  sources:
    - chart: immich
      repoURL: https://immich-app.github.io/immich-charts
      targetRevision: 0.10.3
      helm:
        values: |
          controllers:
            main:
              containers:
                main:
                  image:
                    tag: v2.4.1
                  env:
                    REDIS_HOSTNAME: '{{ printf "%s-valkey" .Release.Name }}'
                    IMMICH_MACHINE_LEARNING_URL: '{{ printf "http://%s-machine-learning:3003" .Release.Name }}'
                    # External PostgreSQL (CloudNativePG)
                    DB_HOSTNAME: "immich-postgres-17-rw"
                    DB_USERNAME: "immich"
                    DB_DATABASE_NAME: "immich"
                    DB_PASSWORD:
                      valueFrom:
                        secretKeyRef:
                          name: immich-postgres-17-app
                          key: password
            
          immich:
            metrics:
              # Enabling this will create the service monitors needed to monitor immich with the prometheus operator
              enabled: false
            persistence:
              # Main data store for all photos shared between different components.
              library:
                # Automatically creating the library volume is not supported by this chart
                # You have to specify an existing PVC to use
                existingClaim: immich-claim
            # configuration is immich-config.json converted to yaml
            # ref: https://immich.app/docs/install/config-file/
            #
            configuration: {}
              # trash:
              #   enabled: false
              #   days: 30
              # storageTemplate:
              #   enabled: true
              #   template: "{{y}}/{{y}}-{{MM}}-{{dd}}/{{filename}}"

          # Dependencies

          valkey:
            enabled: true
            controllers:
              main:
                containers:
                  main:
                    image:
                      repository: docker.io/valkey/valkey
                      tag: 9.0-alpine@sha256:b4ee67d73e00393e712accc72cfd7003b87d0fcd63f0eba798b23251bfc9c394
                      pullPolicy: IfNotPresent
            persistence:
              data:
                enabled: true
                size: 1Gi
                # Optional: Set this to persistentVolumeClaim to keep job queues persistent
                type: emptyDir
                accessMode: ReadWriteOnce
                storageClass: longhorn

          # Immich components

          server:
            enabled: true
            controllers:
              main:
                containers:
                  main:
                    image:
                      repository: ghcr.io/immich-app/immich-server
                      pullPolicy: IfNotPresent
                    # Node trusts its built-in roots, which still include the
                    # ones above the compromised eMudhra intermediates. Use
                    # patched-ca-bundle through OpenSSL until Node ships a fix.
                    env:
                      NODE_OPTIONS: --use-openssl-ca
                      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
            persistence:
              patched-ca-bundle:
                enabled: true
                type: configMap
                name: patched-ca-bundle
                globalMounts:
                  - path: /etc/ssl/certs
                    readOnly: true

          machine-learning:
            enabled: true
            controllers:
              main:
                containers:
                  main:
                    image:
                      repository: ghcr.io/immich-app/immich-machine-learning
                      pullPolicy: IfNotPresent
                    env:
                      TRANSFORMERS_CACHE: /cache
                      HF_XET_CACHE: /cache/huggingface-xet
                      MPLCONFIGDIR: /cache/matplotlib-config
                      # Trust store without the compromised eMudhra
                      # intermediates; requests would otherwise use certifi.
                      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
                      REQUESTS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crt
            persistence:
              patched-ca-bundle:
                enabled: true
                type: configMap
                name: patched-ca-bundle
                globalMounts:
                  - path: /etc/ssl/certs
                    readOnly: true
              cache:
                enabled: true
                size: 10Gi
                # Optional: Set this to persistentVolumeClaim to avoid downloading the ML models every start.
                type: emptyDir
                accessMode: ReadWriteMany
                # storageClass: longhorn

  destination:
    server: https://kubernetes.default.svc
    namespace: immich